Repository navigation
Spend Hardening Effort Where a Failure Can Actually Occur - #2507
Merged
Merged
Conversation
Add a GOVERNANCE.md "Trust Boundaries and Hardening Effort" section: trusted against untrusted input, likelihood times consequence for robustness hardening too, and a decline for a review finding asking for hardening the section rules out. fleet-code-review "Review the Change" carries it as a generated include, local-strict-review asks after races, coercions, and platform differences only where the deployment can produce one, and pr-review-conduct's decline outcome cites it. Fixes #2501 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…g Rule Address the local review: trust follows where data originates, every case short of realistic and silent or destructive is declined, the contradicting host-tool example is gone, the boundary list lives in OPERATIONS.md, and the decline sentences are shortened. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… Untrusted Address the second local review: a host log line recording an outside client's request is untrusted, a failure an outsider can trigger earns a fix, and the boundary list sits under OPERATIONS.md Configuration Layout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…el by Origin Address the third local review: code failing on its ordinary path is a bug and is fixed, any channel holding outsider content is untrusted, and pr-review-conduct's triage list routes ruled-out hardening to outcome 2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Review comments request clarification of the governance wording and alignment with the stated Copilot acceptance criterion.
1 open finding
What changed in this PR
Adds governance rules for proportionate hardening based on realistic deployment risk, and propagates them through review and triage skills.
Changes:
- Adds and registers the new governance section.
- Routes it through repository guidance and review workflows.
- Regenerates GitHub, Claude, and agent skill distributions and digests.
| File | Summary |
|---|---|
spec/section-model.md |
Registers the carried governance section. |
spec/files.json |
Declares section fidelity. |
GOVERNANCE.md |
Defines trust boundaries and hardening criteria. |
AGENTS.md |
Routes agents to the new rule. |
.github/skills/pr-review-conduct/SKILL.md |
Updates triage guidance. |
.github/skills/local-strict-review/SKILL.md |
Scopes review checks by deployment risk. |
.github/skills/fleet-code-review/SKILL.md |
Includes the governance rule. |
.github/skills/drive-pr/SKILL.md |
Updates finding disposition guidance. |
.claude-plugin/fleet-skills/skills/pr-review-conduct/SKILL.md |
Mirrors triage guidance. |
.claude-plugin/fleet-skills/skills/local-strict-review/SKILL.md |
Mirrors review guidance. |
.claude-plugin/fleet-skills/skills/fleet-code-review/SKILL.md |
Mirrors the governance include. |
.claude-plugin/fleet-skills/skills/drive-pr/SKILL.md |
Mirrors disposition guidance. |
.claude-plugin/fleet-skills/.source-digests/pr-review-conduct |
Refreshes source digest. |
.claude-plugin/fleet-skills/.source-digests/local-strict-review |
Refreshes source digest. |
.claude-plugin/fleet-skills/.source-digests/fleet-code-review |
Refreshes source digest. |
.claude-plugin/fleet-skills/.source-digests/drive-pr |
Refreshes source digest. |
.agents/skills/pr-review-conduct/SKILL.md |
Updates canonical triage guidance. |
.agents/skills/local-strict-review/SKILL.md |
Updates canonical review guidance. |
.agents/skills/fleet-code-review/SKILL.md |
Adds the canonical governance include. |
.agents/skills/drive-pr/SKILL.md |
Updates canonical disposition guidance. |
🧠 Review effort: Lite
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #2507 +/- ##
========================================
Coverage 58.50% 58.50%
========================================
Files 16 16
Lines 8066 8066
========================================
Hits 4719 4719
Misses 3347 3347
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Resolve the Copilot acceptance-condition mismatch before approval.
0 open findings
1 resolved since last review
🧠 Review effort: Lite
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
ptr727
added a commit
that referenced
this pull request
Oct 8, 2026
…ctually Occur (#2509) ## Summary Promotes one change from `develop`: - #2507: a new carried `GOVERNANCE.md` section, "Trust Boundaries and Hardening Effort". - Input is trusted or untrusted by where it originates. Against trusted input the only threat is a maintainer's mistake, and untrusted input is validated once at its boundary. - A hardening case earns a fix or an issue only where it can realistically occur in the code's deployment and fails silently, destructively, or at an outsider's trigger. A plain bug is still fixed. - `fleet-code-review` carries the section as a generated include. `local-strict-review` asks after races, coercions, and platform differences only where the deployment can produce one, and `pr-review-conduct` routes a ruled-out hardening finding to an evidence-backed decline. - Declared in `spec/files.json` and `spec/section-model.md`, and routed from `AGENTS.md`. The section is verbatim, so it re-vendors across the fleet on the next resync. Closes #2501. ## Verification - Every check on #2507 passed. Copilot's review covered all 20 changed files, and its one finding was fixed and resolved. - Five `local-strict-review` passes ran. The last two found nothing. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements #2501: a governance rule that hardening effort follows the real risk, not the theoretical one.
GOVERNANCE.md"Trust Boundaries and Hardening Effort", a new carried verbatim section. Input is trusted or untrusted by where it originates, not by the channel carrying it. Against trusted input the only threat is a maintainer's mistake. Untrusted input is validated once at its boundary. A hardening case earns a fix or an issue only where it can realistically occur in the code's deployment and fails silently, destructively, or at an outsider's trigger. A plain bug on the ordinary path is still fixed. A review finding asking for hardening the section rules out is declined, and a repository can name its own boundaries underOPERATIONS.mdConfiguration Layout.spec/files.jsonandspec/section-model.md, and routed from theAGENTS.md"Where the Rules Live" table.fleet-code-review"Review the Change" carries the section as a generated include, so every review brief (local-strict-review, Copilot) reaches it with no new trigger.local-strict-reviewasks after coercions, races, and platform differences only where the code's deployment can produce one.pr-review-conductoutcome 2 and its triage list route a ruled-out hardening finding to an evidence-backed decline.drive-prchanges only through its regenerated include..github/copilot-instructions.mdis deliberately unchanged. Copilot already loadsfleet-code-review, which now carries the rule, and that file forbids duplicatingGOVERNANCE.md.Verification
scripts/build_dist.py --check,spec/validate.py,spec/audit.py --selftest, the prose gate, markdownlint, cspell, and editorconfig-checker all pass.tests/test_build_dist.py,test_canonical_review.py,test_carry.py,test_spec_validate.py,test_repo_gate.py, andtest_release_guards.pyall pass.local-strict-reviewpasses ran. The first three found 9, 3, and 3 defects, each fixed in its own commit, and the fourth found none and is recorded.Refs #2501, which closes on the promotion PR.
🤖 Generated with Claude Code